checkId: check.timestamp.tsa.cert-expiry plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, tsa, certificate, expiry, air-gap]

TSA Certificate Expiry

This Stella Ops Doctor check gives early warning when a TSA signing certificate is approaching expiry, so operators can coordinate renewal with the provider before timestamps stop validating. It is most relevant to operators running compliance-sensitive or air-gapped release pipelines, where evidence signed with an expired certificate may be rejected during audits.

What It Checks

Checks if TSA signing certificates are approaching expiry. The check:

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, the check evaluates locally configured TSA certificates only and adds airGapSealed=true evidence. It does not fetch renewed certificate material from external TSA providers.

In sealed mode, expiry is evaluated against the offline-kit-shipped TSA chain registry (IAirGapArtefactStore) keyed by certificate name; on success the check emits the canonical evidence rows airGapSealed=true, source=offline-kit, artefactSha256=…, artefactIssuedAt=…. When the registry has no chain for a configured certificate, the check fails closed (source=offline-kit-missing) with a remediation hint pointing at var/lib/stellaops/airgap/timestamping/tsa-chains/<name>.pem. Refresh TSA certificate data through the offline kit before the 180-day warning window. The TSA-chain cache TTL is 24 hours.

Why It Matters

An expired TSA signing certificate means new timestamps cannot be validated by relying parties. Evidence signed with an expired certificate may be rejected during compliance audits. Early warning gives operators time to coordinate certificate renewal with the TSA provider before any disruption.

Common Causes

How to Fix

Docker Compose

Update the certificate configuration when renewed certificates are obtained from the TSA provider:

environment:
  Timestamping__TsaCertificates__0__Name: "DigiCert TSA"
  Timestamping__TsaCertificates__0__Subject: "CN=DigiCert TSA"
  Timestamping__TsaCertificates__0__ExpiresAt: "2027-01-15T00:00:00Z"

Bare Metal / systemd

Contact the TSA provider to obtain renewed certificates and update the trust configuration:

stella tsa cert update --name "DigiCert TSA" --cert /path/to/new-cert.pem

Kubernetes / Helm

timestamping:
  certificates:
    warnDays: 180
    criticalDays: 90

Update Kubernetes secrets when new certificates are obtained:

kubectl create secret generic tsa-certs --from-file=cert.pem=/path/to/new-cert.pem --dry-run=client -o yaml | kubectl apply -f -

Verification

stella doctor run --check check.timestamp.tsa.cert-expiry